4 ms·
Isn't it recommended to not make Docker listen on the TCP port?
by brunoqc 10y ago
Isn't it recommended to not make Docker listen on the TCP port?
- dominotw 10y agoeven if protected by tls?
- zenlikethat 10y agoNot sure why you're getting down-voted, exposing the Docker API over a TCP socket using TLS is the only way to even hope to do it safely.
- andrewguenther 10y agoNot exposing it over TCP at all is the only way to do it safely...
- andrewguenther 10y agoYou should always use a UNIX socket if you don't need remote access.
- noinsight 10y agoSSH supports forwarding UNIX sockets...
- andrewguenther 10y agoWould not recommend
- raesene9 10y agoFrom reading the docs, it looks like ctop will connect to the local UNIX socket if there's no environment variable specifying a host, so you don't need to expose a TCP port to get this working.
- zenlikethat 10y agoYes. Otherwise any process which can access the TCP port has full root access on the computer where Docker is installed. And root access to the entire Docker swarm cluster if swarm mode is enabled and the current node is acting as a manager. Whether or not giving root access to a system performance tool is wise is left as an exercise to the reader.